AUSEARCH_ADD...ERPRETED_ITEM(3)

💖 AUSEARCH_ADD_INTERPRETED_ITEM(3) 💖

okay bestie, gather round, because we're doing Linux Audit API today and it's actually so good. this is ausearch_add_interpreted_item from <auparse.h>, and she's a whole mood: she builds up a search rule, one little condition at a time. 🎀

---

✨ NAME ✨

ausearch_add_interpreted_item — build up search rule

🦋 SYNOPSIS 🦋

#include <auparse.h>

int ausearch_add_interpreted_item(auparse_state_t *au, const char *field,
                                  const char *op, const char *value,
                                  ausearch_rule_t how);

🌸 DESCRIPTION 🌸

so basically, ausearch_add_interpreted_item adds one search condition to the current audit search expression. then you can take those search conditions and use them to scan logs, files, or buffers for something of interest. it's giving detective energy, fr fr. 🔍

• field — the field name that the value is gonna be checked for. that's the whole assignment, bestie.
• op — describes what kind of check is being done.

the legal op values are, and yes we're listing all of them:

• exists — just check that a field name exists. that's it, that's the whole job. lowkey the simplest one. ✨
• = — locate the field name and check that the value associated with it is equal to the value given in this rule.
• != — locate the field name and check that the value associated with it is NOT equal to the value given in this rule. the hater of the group, iconic. 💅

the value parameter gets compared to the interpreted field value — aka the value that would be returned by auparse_interpret_field(3). no cap, that's the important bit.

---

🫶 the how value 🫶

the how value determines how this search condition is gonna affect the existing search expression, if one is already defined. the possible values are:

• AUSEARCH_RULE_CLEAR — clear the current search expression, if any, and use only this search condition. starting fresh, main character energy. 💀
• AUSEARCH_RULE_OR — if a search expression E is already configured, replace it by (E || this_search_condition).
• AUSEARCH_RULE_AND — if a search expression E is already configured, replace it by (E && this_search_condition).

ngl these three are the moment. pick wisely which one you want, because CLEAR will absolutely wipe what you had. 🙈

---

⭐ RETURN VALUE ⭐

returns -1 if an error occurs; otherwise, 0 for success. classic. that's the whole vibe check.

🌈 SEE ALSO 🌈

• ausearch_add_expression(3)
• ausearch_add_item(3)
• ausearch_add_timestamp_item(3)
• ausearch_add_regex(3)
• ausearch_set_stop(3)
• ausearch_clear(3)
• ausearch_next_event(3)
• ausearch_cur_event(3)
• ausearch-expression(5)

👑 AUTHOR 👑

Steve Grubb. we stan. 💜

---

okay that's the whole page, you ate that. this absolute classic was brought to you by Red Hat, dated Nov 2007, and it lives in section 3 of the Linux Audit API manual, filed under AUSEARCH_ADD...ERPRETED_ITEM(3). go forth and search, bestie. 🧚✨